Stored Cross-Site Scripting in EdgeEver by Tianma-If
CVE-2026-109557

8.4HIGH

Key Information:

Vendor

Tianma-if

Status
Edgeever
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109557?

EdgeEver, up to version 1.112.0, has a security flaw that permits stored cross-site scripting (XSS) attacks through the setMemoDragPreview function. This vulnerability allows attackers to inject malicious scripts via notebook names or memo titles. The exploit can occur when users create or rename notebooks and memos, leading to the execution of the injected script while utilizing the desktop bridge's session token, potentially compromising sensitive user data and session integrity.

Affected Version(s)

EdgeEver 0.1.0 <= 1.112.0

References

https://github.com/tianma-if/edgeever/issues/534
issue-tracking
https://github.com/tianma-if/edgeever/issues/546
issue-tracking
https://github.com/tianma-if/edgeever/commit/6b5027e8b4be...
patch

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

wgetnz
.